1

I have a problem understanding how a DMZ would be implemented. I've read two different answers regarding the communication between the DMZ and the internal network. Some people suggest that you can open some connections from the DMZ to the some services on the internal network. Other people suggest that absolutely no communication should be allowed from the DMZ to the LAN.

Suppose that I want to implement a webserver on the DMZ that communicates with a database thats inside the LAN. How would i go about this? How would the webserver read the necessary info from the DB without allowing connections from the DMZ to the DB, at least on that single DB port? I've read some people suggesting periodic updates from the DB to the webserver, but that seems like a terribly inefficient solution.

Improve this question
3
  • 4
    so, I think you've answered your own question.
    – Marcus Müller
    Apr 5, 2017 at 15:22
  • I'm not sure what your question is. How to securely connect a server in the DMZ to a DB in the local network? Whether it should be done at all?
    – schroeder ♦
    Apr 5, 2017 at 15:24
  • My question is which is the correct way to configure this in a DMZ. Can a DMZ still be a DMZ even if i start opening ports for specific services? Or should i look for other ways to achieve this? And if so, which are they?
    – Philip
    Apr 5, 2017 at 16:24

1 Answer 1

Reset to default
2

The whole purpose of an architecture with DMZ is to limit direct access from external network to sensitive components of the internal network. Your question itself is self explanatory and it is perfectly normal to allow database communication between webserver situated in DMZ and database server located in internal server farm. From a security perspective it limits the exposure of database server to the public.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .